Patchfirst
Patchfirst
CVE-2024-23113 KEVPublic exploit Critical · 9.8 EPSS 61.7%

Fortinet Multiple Products Format String Vulnerability

Fortinet · Multiple Products

Summary

The flaw is a use of externally-controlled format string in Fortinet's multiple products, affecting FortiOS, FortiProxy, FortiPAM, and FortiSwitchManager across the version ranges listed in the advisory. An attacker who sends specially crafted packets to an affected system can execute unauthorized code or commands, with the attack requiring no authentication or user interaction and only network reachability to the device.

Official description · NVD

A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, FortiPAM versions 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiSwitchManager versions 7.2.0 through 7.2.3, 7.0.0 through 7.0.3 allows attacker to execute unauthorized code or commands via specially crafted packets.

Breakdown
73.6 / 100
Exploited
Yes, in CISA KEV
Reports
1
Tactics
2/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

  1. How attackers get in

  2. What they do

First seen exploited 8 months after disclosure. Public exploit code (PoC-in-GitHub) appeared 8 months after disclosure.

  1. Disclosedday 0
  2. First seen exploitedVulnCheck KEV evidenceAdded to CISA KEVEU database agrees+8 mo
  3. Public exploit codePoC-in-GitHub+8 mo
  4. Named in a threat reportctrlaltintel.com+2 yrs

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

techniques

2 , grouped by in kill-chain order, 2 cited passages 2

Initial AccessTA0001

Exploit Public-Facing Application T1190 Medium
AI mapping from the description · how it is exploited

Network-exploitable via crafted packets to public-facing devices

allows attacker to execute unauthorized code or commands via specially crafted packets
From the official description (NVD) Original (opens in a new tab) ↗

ExecutionTA0002

Command and Scripting Interpreter T1059 Medium
AI mapping from the description · primary impact

Format string flaw yields unauthorized code execution

allows attacker to execute unauthorized code or commands via specially crafted packets
From the official description (NVD) Original (opens in a new tab) ↗

Detection

0 rules for this CVE · 244 general rules for its techniques

Rules for this CVE

0 that reference CVE-2024-23113 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Exploit Public-Facing ApplicationT1190149 general rules
All 149 on SigmaHQ ↗
Command and Scripting InterpreterT105995 general rules
All 95 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

What security researchers reported

Named in 1 threat report
1 reportctrlaltintel.comMar 2026

Reports are matched by finding the exact id CVE-2024-23113 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

2 links, grouped by NVD tag (1 duplicate merged)

Vendor Advisory 1

fortiguard.com/psirt/FG-IR-24-029

US Government Resource 1

cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-23113
↑ ↓ chooseEnter openEsc close